Bug fixes (real breakage):

Newsletter nudge — was calling /api/study-account/profile (wrong endpoint, ignored subscription). Now correctly calls /api/study-account/preferences with PATCH.
Security:

Email regex — replaced the permissive [^\s@]+@[^\s@]+ pattern with a proper RFC-compliant regex in contact.js and downloads.js
Avatar magic bytes — server now checks actual PNG/JPEG/GIF/WEBP header bytes, not just the data URL prefix
Certificate rate limit — public /api/public/certificate/:token now has a 30 req/15min limiter
Session absolute TTL — admin sessions now have a 30-day hard cap; a stolen token can no longer be kept alive indefinitely by passive reads
Account lockout — 5 failed logins locks a study account for 1 hour
CSP headers — Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers added globally
Data integrity:

Cascade delete — deleting a study account now also removes their certificates, community posts, comments, and progress file
UX / reliability:

Escape key on modals — all 3 modal groups (study index, notes, account) now close on Escape
Display name min-length — empty spaces-only names rejected; if provided, must be ≥2 chars
Note save rate limit — 30 saves/minute per user max
Analytics fetch timeout — 5s AbortController so a hanging server doesn't block the browser indefinitely
Email validation on signup — frontend catches bad email formats before hitting the server
Cleanup:

Deduplicated download forms — StudyDownloadForm and ResourceDownloadForm now share a single DownloadForm base; both are now thin wrappers

server/routes/study-account.js

@@ -8,11 +8,15 @@ import { UPLOADS_DIR, EMAIL_CHANGE_TOKEN_TTL_MS } from '../config.js'
 import { state } from '../state.js'
 import {
   queueStudyUsersWrite,
+  queueStudyCommunityWrite,
+  queueStudyCommentsWrite,
+  queueStudyCertificatesWrite,
   readUploadsMetadata,
   writeUploadsMetadata,
   loadUserNotes,
   loadUserProgress,
   getUserNotesFilePath,
+  getUserProgressFilePath,
 } from '../data.js'
 import {
   requireStudyAuth,
@@ -259,6 +263,17 @@ export function register(app) {
         return
       }
 
+      const isValidImageBytes = (
+        (buffer[0] === 0xFF && buffer[1] === 0xD8 && buffer[2] === 0xFF) || // JPEG
+        (buffer[0] === 0x89 && buffer[1] === 0x50 && buffer[2] === 0x4E && buffer[3] === 0x47) || // PNG
+        (buffer[0] === 0x47 && buffer[1] === 0x49 && buffer[2] === 0x46) || // GIF
+        (buffer[0] === 0x52 && buffer[1] === 0x49 && buffer[2] === 0x46 && buffer[3] === 0x46) // WEBP (RIFF)
+      )
+      if (!isValidImageBytes) {
+        res.status(400).json({ message: 'Upload must be a valid PNG, JPG, WEBP, or GIF image.' })
+        return
+      }
+
       const baseName = normalizeAssetBaseName(filename.replace(/\.[a-z0-9]+$/i, ''))
       const finalName = `${baseName || 'avatar'}-${Date.now()}${ext}`
 
@@ -444,6 +459,21 @@ export function register(app) {
     state.studyNotesCache.delete(user.id)
     try { await unlink(getUserNotesFilePath(user.id)) } catch { /* no notes file is fine */ }
 
+    state.studyProgressCache.delete(user.id)
+    try { await unlink(getUserProgressFilePath(user.id)) } catch { /* no progress file is fine */ }
+
+    const beforeCerts = state.studyCertificates.length
+    state.studyCertificates = state.studyCertificates.filter(c => c.userId !== user.id)
+    if (state.studyCertificates.length !== beforeCerts) queueStudyCertificatesWrite()
+
+    const beforePosts = state.studyCommunityPosts.length
+    state.studyCommunityPosts = state.studyCommunityPosts.filter(p => p.authorUserId !== user.id)
+    if (state.studyCommunityPosts.length !== beforePosts) queueStudyCommunityWrite()
+
+    const beforeComments = state.studyComments.length
+    state.studyComments = state.studyComments.filter(c => c.userId !== user.id)
+    if (state.studyComments.length !== beforeComments) queueStudyCommentsWrite()
+
     sendStudyAccountDeletedEmail(deletedEmail, deletedDisplayName).catch(err => {
       console.error('[study-account] delete email error:', err)
     })